* feat: possibility to inject id_token in redirect url during sign out
Signed-off-by: Alban Fonrouge <alban.fonrouge@visma.com>
* doc: changelog for #3278
Signed-off-by: Jan Larwig <jan@larwig.com>
* test: fix assertion for TestIdTokenPlaceholderInSignOut
Signed-off-by: Jan Larwig <jan@larwig.com>
---------
Signed-off-by: Alban Fonrouge <alban.fonrouge@visma.com>
Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
* docs: add Kubernetes Dashboard integration guide for Azure Entra ID
Add comprehensive documentation for integrating oauth2-proxy with
Kubernetes Dashboard on Azure Kubernetes Service (AKS) using Azure
Entra ID authentication.
Changes:
- Add new section "Kubernetes Dashboard on AKS" to ms_entra_id.md
with complete configuration examples including:
- Architecture overview and integration flow
- Alpha configuration for oauth2-proxy Helm chart
- Dashboard Ingress with proper auth annotations
- RBAC configuration (user-based and group-based)
- Troubleshooting guide for common issues
- Workload Identity (passwordless) setup
- Add reference link in integration.md pointing to the new section
for users looking for Kubernetes Dashboard integration examples
This addresses common issues users face when integrating Dashboard
with Entra ID, particularly:
- Missing Authorization header in auth-response-headers
- Insufficient buffer sizes for large Entra ID tokens
- RBAC permission configuration
- Group claims setup
Closes: oauth2-proxy/manifests#348
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
* docs: split integration.md into separate integration guides
Split the monolithic integration.md file into a structured integrations
directory with individual pages for each tool as requested by maintainer.
Changes:
- Create new docs/configuration/integrations/ directory structure
- Split content into separate files:
- nginx.md: Nginx auth_request directive configuration
- traefik.md: Traefik v2 ForwardAuth middleware setup
- caddy.md: Caddy v2 forward_auth directive configuration
- kubernetes-dashboard.md: K8s Dashboard integration (with deprecation notice)
- headlamp.md: Headlamp integration guide (recommended alternative)
- Transform integration.md into an index/overview page linking to all integrations
- Update docs/sidebars.js to use new Integration Guides category structure
The content has been preserved as-is from the original file, only
reorganized into separate files for better maintainability and
navigation. Added deprecation notice for Kubernetes Dashboard per
https://github.com/kubernetes/dashboard/commit/0ba796dce6916bb6ca5da5ca0b3ab22cecfd1e18
Addresses maintainer feedback from PR #3299
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
* fix: restore Kubernetes Dashboard tip box in nginx integration docs
Add back the tip box referencing the Kubernetes Dashboard Azure Entra ID
integration example that was present in the original integration.md file.
This ensures all content from the original file is preserved in the split
documentation structure.
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
* refactor: move Kubernetes Dashboard details to integration guide
Move the detailed Kubernetes Dashboard integration content from the
ms_entra_id provider documentation to the integrations section where
it logically belongs.
Changes:
- Move complete K8s Dashboard guide from ms_entra_id.md to
integrations/kubernetes-dashboard.md (architecture, configuration,
RBAC, troubleshooting, Workload Identity)
- Replace detailed section in ms_entra_id.md with brief reference
to integration guide
- Reorder sidebar: Headlamp before Kubernetes Dashboard
- Update integration.md index to show Headlamp first (recommended),
Dashboard last (deprecated)
This improves documentation organization by keeping integration guides
in the integrations/ directory and provider docs focused on provider
configuration.
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
* docs: move integration.md to integrations/index.md
Signed-off-by: Jan Larwig <jan@larwig.com>
---------
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
* Add check for constraints to the proxy endpoint
* Add tests for allowed_groups query string
* Add this feature to the changelog
* Apply suggestions from code review
Co-authored-by: Jan Larwig <jan@larwig.com>
* Use explicit key names in TestProxyAllowedGroups
* Document the query parameters on proxy endpoint
* Comment was copied from the AuthOnly handler but on closer inspection is not relevant here
replacing comment with one more relevant
---------
Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
* feat: readiness check
* fix: no need for query param
* docs: add a note
* chore: move the readyness check to its own endpoint
* docs(cr): add godoc
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
* Add allowed_emails option to the auth endpoint query string
* Don't return true from checkAllowedEmailsOrDomains only because domains field was empty
* Fix checkAllowedEmailsOrDomains logic
* Added tests for allowed_emails query parameter
* Updated CHANGELOG
* Remove checkAllowedEmailsOrDomains
Co-authored-by: Nick Meves <nicholas.meves@gmail.com>
Add the Prometheus http.Handler to serve metrics at MetricsPath ("/metrics"
by default). This allows Prometheus to scrape metrics from OAuth2 Proxy.
Add a new middleware NewRequestMetrics and attach it to the preAuth
chain. This will collect metrics on all requests made to OAuth2 Proxy
Collapse some calls to Prinf() and os.Exit(1) to Fatalf as they are
equivalent. main() has a strict 50 lines limit so brevity in these
calls appreciated
